registry  /  @threadplane/langgraph  /  0.0.56

@threadplane/langgraph@0.0.56

LangGraph adapter for @threadplane/chat — Angular bindings for LangGraph Platform.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Unresolved install-time execution exists because npm postinstall invokes a dependency-provided telemetry command. The inspected bundled source itself shows ordinary LangGraph client/runtime adapter behavior and no confirmed malicious payload.

Static reason
One or more suspicious static signals were detected.
Trigger
npm install runs package.json postinstall
Impact
Unconfirmed install-time code execution from dependency; no source evidence of exfiltration or destructive behavior in this package
Mechanism
dependency-provided postinstall telemetry command
Rationale
The package should not be blocked because direct source inspection found no credential theft, payload loading, persistence, destructive behavior, or AI-agent control hijack. The uninspected dependency-provided postinstall plus wildcard dependency is a real install-time risk, so a warning is appropriate.
Evidence
package.jsonfesm2022/threadplane-langgraph.mjstypes/threadplane-langgraph.d.tsREADME.md

Decision evidence

public snapshot
AI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • package.json defines postinstall: threadplane-telemetry-postinstall || true
  • package.json depends on @threadplane/telemetry with wildcard version
Evidence against
  • No bundled bin or implementation for the postinstall command in package files
  • fesm2022/threadplane-langgraph.mjs is Angular/LangGraph adapter code using @langchain/langgraph-sdk Client with caller-provided apiUrl
  • Runtime telemetry only calls an app-provided sink; no hardcoded exfiltration endpoint found
  • No child_process, eval/Function, filesystem writes, credential harvesting, or AI-agent config writes found in bundled source
Behavioral surface
Source
Filesystem
Supply chainNo supply-chain packaging signals triggered.
Manifest
WildcardDependency
scanned 1 file(s), 142 KB of source

Source & flagged code

2 flagged · loading source
package.jsonView file
•scripts.postinstall = threadplane-telemetry-postinstall || true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = threadplane-telemetry-postinstall || true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High2 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumWildcard Dependency
LowScripts Present
LowFilesystem